Microsoft Data Access Internet Publishing Provider Protocol Discovery

OPTIONS <-? Let's see...Head, Get and Post.

[pendanticist]

But OPTIONS?

dhcp173-80.nursing.emory.edu - - [06/Jan/2003:09:01:04 -0800] "OPTIONS / HTTP/1.1" 200 - "-" "Microsoft Data Access Internet Publishing Provider Protocol Discovery"

dhcp173-80.nursing.emory.edu - - [06/Jan/2003:09:01:04 -0800] "OPTIONS /Violence_Prevention.html HTTP/1.1" 200 - "-" "Microsoft Data Access Internet Publishing Provider Protocol Discovery"

dhcp173-80.nursing.emory.edu - - [06/Jan/2003:09:01:05 -0800] "GET /_vti_inf.html HTTP/1.1" 403 223 "-" "Mozilla/2.0 (compatible; MS FrontPage 5.0)"

170.140.173.80 - - [06/Jan/2003:09:01:05 -0800] "POST /_vti_bin/shtml.exe/_vti_rpc HTTP/1.1" 403 237 "-" "MSFrontPage/5.0"

dhcp173-80.nursing.emory.edu - - [06/Jan/2003:09:01:05 -0800] "OPTIONS / HTTP/1.1" 200 - "-" "Microsoft Data Access Internet Publishing Provider Protocol Discovery"

dhcp173-80.nursing.emory.edu - - [06/Jan/2003:09:01:05 -0800] "OPTIONS /Violence_Prevention.html HTTP/1.1" 200 - "-" "Microsoft Data Access Internet Publishing Provider Protocol Discovery"

dhcp173-80.nursing.emory.edu - - [06/Jan/2003:09:01:05 -0800] "GET /Violence_Prevention.html HTTP/1.1" 304 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

(Notice it reverts to IP address?)

For the moment, I'll assume the above is due to the owner/user of FP downloading my material?

If so, what's the best method for banning?

Here's what I have, that doesn't seem to work.

RewriteCond %{HTTP_USER_AGENT} ^FileHound [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlashGet [OR]
RewriteCond %{HTTP_USER_AGENT} FrontPage [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^gazz/2.1 [OR]
RewriteCond %{HTTP_USER_AGENT} ^GetRight [OR]

Suggestions anyone?

Pendanticist.

[DaveAtIFG]

Here's what I have, that doesn't seem to work.

It looks as if it should work to me... Let's see what the mod_rewrite wizards think.

[bird]

OPTIONS is a legitimate request, and will just tell the client that your server (probably) doesn't support the data access operations they're after.

None of the patterns in your .htaccess excerpt matches anything in the UA of those OPTION requests, so that 200 is the correct response. In contrast, the FrontPage requests get denied by 403.

What exactly is it that you think "doesn't seem to work" here?

[pendanticist]

What exactly is it that you think "doesn't seem to work" here?

RewriteCond %{HTTP_USER_AGENT} FrontPage [NC,OR]

Isn't this proper for banning FP?

Pendanticist.

[bird]

That will match any request that has "FrontPage" somewhere in the UA string. The bolded line in your log excerpt above demonstrates the result. A response code of 403 means "access denied".

Again: Why do you think something is wrong with your rules?
Which part of your log doesn't satisfy your expectations?

[pendanticist]

Which part of your log doesn't satisfy your expectations?

The request immediately following the 403 ( I really knew what that meant ;) ) shows a 200.

According to [w3.org...] a 200 ='s

10.2.1 200 OK
The request has succeeded.

So then, seeing a denied request following a succeeded request led me to conclude my .htaccess ban list was not functioning properly.

Upon closer inspection, I see all these actions took place within nano-seconds of each other. Safe to say this is what threw me?

Pendanticist.